IMAGE: ERIC CARTER/WSJ
IN SEPTEMBER hackers injected malware into the Nepal Electronic Payment System (NEPS), a card‑switching infrastructure shared by dozens of banks. The malware instructed ATMs to dispense cash before the withdrawal request reached the member bank, effectively allowing unauthorised withdrawals. Post‑incident analyses cited by local media identified keyloggers and “smokescreen” techniques. A subsequent internal review (leaked to press at the time) reportedly described aspects of the central bank’s digital security as having been “handled carelessly”, though the Nepal Rastra Bank never formally adopted that phrasing in a public report.
Nepal has expanded digital financial services rapidly. By mid‑2024 NRB data showed some 23.7m mobile banking subscriptions (not necessarily unique users) and 1.9m internet banking users in a country of about 30m people. According to the Nepal Telecommunications Authority, mobile broadband penetration exceeded 90%: a figure based on active SIM connections. The growth has advanced financial inclusion, but many banks’ security teams, staffing levels as well as tools have struggled to keep pace, according to multiple NRB cybersecurity assessments and industry interviews.
Several smaller commercial banks and development banks continue to run legacy core banking systems that no longer receive security patches from vendors. Staff security training is inconsistent. The NRB’s own reviews note that phishing attacks succeed in part because many employees have not received systematic, up‑to‑date training. And vendor access controls are often weak, creating potential backdoors through third‑party software providers.
A documented example: in 2024 F1Soft, a major digital payment service provider, suffered an SQL injection breach. Unauthorised transactions led to a reported loss of Rs34.2m, and some 12,500 customer records were exposed, according to contemporaneous news reports. This attack used a basic, well‑understood exploit that a properly patched web application would likely have blocked.
The Nepal Rastra Bank has issued cybersecurity directives (latest update 2023). The government’s Computer Emergency Response Team (CERT‑Nepal), under the Department of Information Technology, conducts audits and awareness programmes. In 2024 a new entity, the Information Technology Security Emergency Response Team (ITSERT), was launched to speed incident response, though its operational capacity remains modest. The National Cybersecurity Strategy 2080 (2023-24) outlines a multi‑sectoral approach. However, independent experts note that funding and staffing for these bodies remain far below the level seen in India’s CERT‑In, which operates with larger teams and more advanced analytics.
Mobile payments and internet banking have brought financial services to millions of Nepalis who previously lacked access to physical branches. Dismantling those systems is not a solution. The pressing need—widely acknowledged by the NRB, commercial banks and international donors—is to accelerate security investment, enforce regular patching, mandate consistent staff training and close regulatory gaps at a pace that matches the threat. ■
